CVE-2026-114253
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A vulnerability was determined in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. The impacted element is the function include of the file index.php. Executing a manipulation of the argument page can lead to file inclusion. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
Risk Assessment
A remote attacker can include arbitrary files, potentially leading to code execution or information disclosure.
Recommendation
Update the software to the latest version if available and restrict access to the application.
Other vulnerabilities in file-management-system-php
See all- CVE-2026-114260Medium
In oretnom23 file-management-system-php (up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4), the delete_folder function in ajax.php (AJAX Handler component) lacks authentication when the ID argument is manipulated. The vulnerability can be exploited remotely and a public exploit is already available.
- CVE-2026-114259High
In oretnom23 file-management-system-php (up to commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4), the save_files function in admin_class.php allows unrestricted file upload via manipulation of the Upload argument. The exploit has been published and can be launched remotely.
- CVE-2026-114257High
A security vulnerability has been detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. The readfile function in download.php is affected by manipulation of the ID argument leading to SQL injection; the attack may be performed remotely and a public exploit exists.
- CVE-2026-114256High
A SQL injection vulnerability was identified in file-management-system-php within the save_folder, delete_folder, delete_file, file_rename, and save_files functions of admin_class.php (Folder Management component). Manipulating the name/parent_id/id/type/folder_id/description arguments allows SQL injection. The flaw can be exploited remotely and a public exploit is available.
- CVE-2026-114254High
A vulnerability was identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the Login function in admin_class.php. Manipulation of the username/password argument leads to SQL injection. Remote exploitation is possible, and the exploit is publicly available and might be used. The product follows a rolling release approach, so version details are not provided. The project was informed but has not responded yet.
Original NVD description (English source)
A vulnerability was determined in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. The impacted element is the function include of the file index.php. Executing a manipulation of the argument page can lead to file inclusion. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS